How to Write a Cybersecurity Analyst Job Description
A cybersecurity analyst job posting needs to screen for real threat detection and incident response, not just running scans — not just list duties. Here's what to include and what actually filters for the right candidates.
What this role actually needs to prove out
Before writing requirements, get clear on the one thing a strong cybersecurity analyst candidate has to demonstrate: real threat detection and incident response, not just running scans. Every requirement you list should trace back to that, not to a generic template for the job title. A posting that just restates the job title in bullet-point form filters for nothing — it neither attracts strong candidates nor repels weak ones.
Must-have requirements to include
Keep this list short and real — these are the skills that actually predict success in the role, not a wish list:
- Threat detection/monitoring (SIEM tools)
- Incident response
- Vulnerability assessment
- Security compliance frameworks
- Network security fundamentals
Nice-to-have — list separately, don't gate on these
Worth calling out as a plus, but requiring them as "must-haves" needlessly shrinks your pool:
- Security certifications (Security+, CISSP, etc.)
- Penetration testing experience
- Cloud security experience
What a strong candidate's resume bullet looks like
Useful as a benchmark when screening — this is roughly what real, specific evidence of the role's core skill looks like on paper:
- Monitored security events across 500+ endpoints, reducing average incident-detection time by 40%
- Led incident response for a phishing campaign, containing it within 2 hours with zero data exfiltration
- Conducted a vulnerability assessment that identified and closed 30 critical security gaps
Titles candidates search for
People in this job look under several names: Security Analyst, SOC Analyst, Information Security Analyst, Security Engineer. Use the title most of them search for as your heading, and work one or two of the others into the text so the posting is found by all of them.
A tip specific to this role
Name the tools, the shift pattern and whether the role is monitoring, response or engineering.
What to look for on the CV
Incidents handled, the tools used and detection work.
Credentials and checks to confirm
Security certifications are common. Confirm the clearance level if the work needs one.
A starting job description for a cybersecurity analyst
Fill in the brackets with your own details. The requirements come from this role's must-haves, so edit them to match your site.
Cybersecurity Analyst About the role [Two sentences on your team and what this person will own.] What you will do - [Three to five responsibilities specific to your site] What you need - Threat detection/monitoring (SIEM tools) - Incident response - Vulnerability assessment - Security compliance frameworks - Network security fundamentals A plus - Security certifications (Security+, CISSP, etc.) - Penetration testing experience - Cloud security experience Before you start - Security certifications are common. Confirm the clearance level if the work needs one. What we offer - [Pay range, hours or shift pattern, location]
Notice periods & salary disclosure, by country
Hiring for this role in a specific market? These vary enough to affect your timeline and posting requirements — see the full sourcing and interview guides for this role too.
| Country | Typical notice period | Salary disclosure |
|---|---|---|
| 🇮🇳 India | 30-90 days is standard, often negotiable with a buyout | Not legally required; increasingly expected on job boards for volume roles |
| 🇺🇸 United States | At-will employment — typically 2 weeks, not legally mandated | Increasingly required by state law (CA, CO, NY, WA and others) to post a range |
| 🇬🇧 United Kingdom | 1 week to 3 months depending on seniority and contract, often longer for senior roles | Not legally required, but a stated range is increasingly expected and improves application rates |
| 🇨🇦 Canada | 2 weeks is common but varies by province's employment standards | Legally required in Ontario and British Columbia for job postings; increasingly expected elsewhere |
| 🇦🇺 Australia | 2-4 weeks typical, sometimes longer for senior roles | Not legally required nationally, but expected on major job boards and increasingly the norm |
| 🇲🇽 Mexico | Typically 1-2 weeks by custom, though not always formally mandated | Not commonly disclosed in postings, but expected during initial screening conversations |
| 🇧🇷 Brazil | 30 days is the statutory minimum under CLT employment | Not commonly disclosed in postings; increasingly common for international-facing roles |
| 🇻🇳 Vietnam | 30-45 days is standard for formal employment contracts | Not commonly disclosed for local roles; more common for international/remote postings |
| 🇮🇩 Indonesia | 30 days is the common statutory minimum for formal contracts | Not commonly disclosed for local roles; more common for international/remote postings |
| 🇫🇷 France | 1-3 months depending on role and collective bargaining agreement (convention collective) | Not legally required in postings, but increasingly expected |
| 🇦🇪 United Arab Emirates | 30-90 days typical, often defined explicitly in the employment contract | Not commonly disclosed in postings; discussed directly during screening |
| 🇩🇪 Germany | Typically 4 weeks to 3 months, longer with tenure — governed by contract and law (Kündigungsfrist) | Not legally required nationally, but increasingly common and expected by candidates |
| 🇯🇵 Japan | 2 weeks statutory minimum, though 1-3 months is customary by company policy | Not commonly disclosed in postings; discussed during the process, sometimes via a recruiter intermediary |
| 🇵🇱 Poland | 2 weeks to 3 months depending on contract type and tenure | Legally required in job postings as of the EU Pay Transparency Directive's national implementation |
| 🇵🇭 Philippines | 30 days is the common standard under the Labor Code | Not commonly disclosed for local roles; more common for BPO/international postings |
| 🇸🇬 Singapore | 1 week to 3 months, commonly defined explicitly in the employment contract | Not legally required, but a stated range is increasingly standard practice, especially for tech roles |
Mistakes that scare off good candidates
- Requiring years of experience as a proxy for skill (e.g. gating on "5+ years" when the real bar is demonstrated competence) — filters out strong candidates with less conventional paths.
- Listing every tool/skill your team has ever touched as a "must-have," rather than the handful that actually predict success.
- Burying the actual role and responsibilities under generic company boilerplate that could apply to any posting.
- Not stating the shift pattern for monitoring roles.
Frequently asked questions
What should I put at the top of a cybersecurity analyst job posting?
A short intro (1-2 sentences) on the role and team, then straight into responsibilities and requirements. Candidates skim the first few lines to decide whether to keep reading — don't bury the actual role behind company boilerplate.
How many requirements should a cybersecurity analyst job description list?
Split them into must-have (5 or fewer — every extra must-have measurably shrinks your applicant pool) and nice-to-have. A JD that lists 15 "requirements" with no distinction screens out strong candidates who'd have been a genuinely good fit.
Should I list a salary range?
Where legally required or common in your market, yes — it's increasingly expected, and its absence is one of the top reasons strong candidates skip an otherwise good posting without applying.
What other titles do people use for a cybersecurity analyst?
The same job is also called Security Analyst, SOC Analyst, Information Security Analyst, Security Engineer. Use the title candidates search for in the posting, and mention the others once in the text so the posting is found.
What should I check before hiring a cybersecurity analyst?
Security certifications are common. Confirm the clearance level if the work needs one.
Hiring a cybersecurity analyst? The rest of the toolkit
- Search strings to find candidates →
Five searches from broad to narrow, with exclusions.
- Interview questions to ask →
Role-specific questions and what a good answer contains.
- Run the whole hire in one place →
Jobs, CV review, interviews, offers and checks together.